jakman85 e49b86eb41 merge: 35 runbooks, served, with a guard that they resolve ...

All 46 runbook_url annotations pointed at https://<apex>/runbooks/<name>
and every one returned 404 — there was no runbooks/ directory and no route.
Every alert that reached a human handed them a dead link at the moment they
needed it.

Runbooks are now served from their own non-gating tier at the apex prefix,
PUBLIC on purpose: gating them behind Keycloak would make keycloak-down
unreadable exactly when Keycloak is down, which is a loop with no exit. The
new L0 guard checks both directions — a runbook_url with no file, and a file
not wired into the generator — and it caught a live one on contact with
main: CNPGPrimariesCoLocated had shipped hours earlier pointing at a runbook
that did not exist.

2026-09-13 00:11:03 -05:00

..

alert-rules-unit-tested

feat(ci): promtool in the pinned toolchain, one alert-rule harness, and the gaps declared

2026-09-13 00:02:27 -05:00

alert-runbooks-resolvable

fix(runbooks): declare whole-repo scope, drop the bespoke l0 stage, +cnpg-primary-spread

2026-09-13 00:00:24 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

ha-control-plane-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

keycloak-client-secret-reconciler

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

placeholder-guard-coupling

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

whole-repo-invariants-wired

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00